SB20260720365 - Fedora 45 update for containerd
Published: July 20, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 7 vulnerabilities.
1) Improper input validation (CVE-ID: CVE-2026-34986)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper input validation in JWE decryption in key_wrap.go when processing a JWE object with a key wrapping algorithm and an empty encrypted_key field. A remote attacker can send a specially crafted JWE object to cause a denial of service.
The issue is reachable through ParseEncrypted(), ParseEncryptedJSON(), or ParseEncryptedCompact() followed by Decrypt(), and applications are affected only if accepted key algorithms include key wrapping algorithms.
2) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-35469)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a remote user to perform a denial of service (DoS) attack.
The vulnerability exists due to SPDY/3 frame parser does not validate attacker-controlled counts and lengths before allocating memory. A remote user can trigger resource exhaustion and perform a denial of service (DoS) attack.
3) Insufficient verification of data authenticity (CVE-ID: CVE-2026-50195)
CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity
CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a local user to execute arbitrary code.
The vulnerability exists due to insufficient verification of data authenticity in the CRI checkpoint import process when processing image references in a checkpoint image's configuration. A local user can create a crafted checkpoint image to poison the local image cache and execute arbitrary code.
Exploitation requires permissions to create pods, and affected pods must later use the poisoned tag with an IfNotPresent or Never pull policy on the same node.
4) Input validation error (CVE-ID: CVE-2026-53488)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
The vulnerability allows a remote attacker to execute arbitrary commands on the host.
The vulnerability exists due to improper input validation in the containerd CRI plugin when propagating image configuration labels to containers. A remote attacker can supply a crafted image with malicious labels to execute arbitrary commands on the host.
Exploitation requires a plugin that consumes container labels for some operations.
5) Incorrect authorization (CVE-ID: CVE-2026-53492)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a remote user to bypass device allocation controls and inject arbitrary CDI configuration into a restored container.
The vulnerability exists due to improper input validation and incorrect authorization in containerd CRI checkpoint restore handling when restoring a container from an untrusted checkpoint image. A remote user can create a pod and restore it from a crafted checkpoint image to bypass device plugin enforcement and inject arbitrary CDI edits into the restored container.
Only nodes with CDI enabled and a matching host CDI specification for the requested device are vulnerable.
6) UNIX symbolic link following (CVE-ID: CVE-2026-53489)
CWE-ID: CWE-61 - UNIX Symbolic Link (Symlink) Following
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to disclose sensitive information from the host.
The vulnerability exists due to symlink following in the CRI plugin checkpoint restore handling of container.log when restoring a checkpoint image. A remote attacker can supply a crafted checkpoint image containing a symlinked path to disclose sensitive information from the host.
The issue can expose host files via kubectl logs.
7) Resource exhaustion (CVE-ID: CVE-2026-47262)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in group parsing when creating a container from a maliciously crafted image. A remote user can supply a specially crafted image to cause a denial of service.
Successful exploitation can exhaust memory and trigger an out-of-memory kill of the containerd process, making the runtime API unavailable.
Remediation
Install update from vendor's website.